CVE-2026-66000 in Frappe
Summary
by MITRE • 08/07/2026
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email. This issue is fixed in versions 16.23.0 and 15.112.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability resides within the Frappe web application framework's notification system where document follow functionality fails to properly validate recipient permissions during email generation. The flaw allows for privilege escalation through information disclosure by enabling users who previously had access to documents to continue receiving sensitive data via email notifications even after their permissions have been revoked or reduced. This represents a critical access control weakness that directly violates the principle of least privilege and can lead to unauthorized data exposure.
The technical implementation issue stems from the notification generation process not performing proper permission re-evaluation before sending document data to recipients. When users lose access to specific documents through role modifications, permission revocations, or access removal, the system should ensure that no further notifications containing that document's data are sent to those users. However, the vulnerability allows continued delivery of document information to revoked users because the system does not cross-reference current access rights with pending notification queues.
From an operational perspective this vulnerability creates significant security risks including potential data leakage, compliance violations, and insider threat exploitation. An attacker who has been granted access to certain documents but subsequently loses that access could continue receiving sensitive information through email notifications, effectively bypassing intended access controls. The impact is particularly severe in environments where document-level permissions are strictly enforced and where audit trails require accurate representation of user access rights.
The vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic case of insufficient authorization checking during notification processing. According to ATT&CK framework, this maps to T1078 (Valid Accounts) and T1566 (Phishing) as it enables continued access through legitimate notification channels and can be exploited by attackers who gain temporary access to accounts that are subsequently restricted. Organizations using Frappe frameworks should immediately implement version updates to 16.23.0 or 15.112.0 to address this vulnerability, while also conducting thorough permission audits to identify any potential unauthorized data exposure that may have occurred through this flaw.
Mitigation strategies should include immediate deployment of patched versions, implementation of automated permission validation checks for notification systems, and regular security assessments of access control mechanisms. Organizations should also establish monitoring procedures to detect unusual notification patterns that might indicate continued information flow to revoked users. Additionally, administrators should review and test document permission configurations to ensure proper enforcement of access controls throughout the notification lifecycle. The fix implemented in versions 16.23.0 and 15.112.0 addresses the core issue by ensuring that document follow notifications re-evaluate recipient permissions before sending email content, thereby preventing unauthorized data disclosure through notification channels.